10h30/ultimatemember
1
0
Fork 0
mirror of https://github.com/10h30/ultimatemember.git synced 2026-07-17 21:53:43 +09:00
Code Issues Packages Projects Releases Wiki Activity

Add validation for banned and blacklisted custom fields.

Browse Source 
This update enhances security by introducing checks for banned and blacklisted meta keys in custom fields. It includes CSS updates for admin builder styles and ensures banned fields are flagged accurately in the site health tool.
This commit is contained in:
Mykyta Synelnikov
2025-04-15 18:08:44 +03:00
parent 8ef597ad74
commit f89b29426a
7 changed files with 95 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files
includes/core/class-builtin.php
+7 -1
View File
@@ -34,6 +34,9 @@ if ( ! class_exists( 'um\core\Builtin' ) ) {
public $saved_fields = array();
/**
* Field keys that cannot be used as metakey when add new custom field to UM Form.
* Note: They are used both with function `UM()->user()->is_metakey_banned()` to avoid using unsecure metakeys.
*
* @var array
*/
public $blacklist_fields = array();
@@ -183,7 +186,7 @@ if ( ! class_exists( 'um\core\Builtin' ) ) {
* @return int|string Empty or error string.
*/
public function blacklist_field_err( $key ) {
if ( in_array( strtolower( $key ), $this->blacklist_fields, true ) || in_array( strtolower( $key ), UM()->user()->banned_keys, true ) ) {
if ( in_array( strtolower( $key ), $this->blacklist_fields, true ) || UM()->user()->is_metakey_banned( $key ) ) {
return __( 'Your meta key can not be used', 'ultimate-member' );
}
@@ -1426,6 +1429,9 @@ if ( ! class_exists( 'um\core\Builtin' ) ) {
public function set_blacklist_fields() {
$this->blacklist_fields = array(
'id',
'role',
'user_id',
'user_pass',
);
/**